CVE-2015-1503: IceWarp Mail Server directory traversal in webmail scripts

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though no KEV listing or confirmed active campaign is recorded.

What it is

IceWarp Mail Server before 11.2 contains multiple directory traversal flaws in webmail PHP endpoints. The file parameter of webmail/client/skins/default/css/css.php and the script and style parameters of webmail/old/calendar/minimizer/index.php accept traversal sequences, letting a remote attacker read files outside the web root. Because the affected paths are reachable without credentials, exposed servers leak configuration and credential material.

Impact

An attacker can read arbitrary files readable by the web server process, including mail server configuration and stored credentials. There is no write or code execution impact in the record; the effect is confidentiality loss only.

Attack surface

Reached over the network via HTTP requests to the two webmail PHP endpoints, with no authentication and no user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or intranet-exposed IceWarp webmail interface is in scope.

Exploitation

Public exploit code exists in Exploit-DB and Packet Storm, and EPSS is 0.57633 (99th percentile), indicating high likelihood of attempted exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild campaign is documented in this record.

What to do

• Upgrade IceWarp Mail Server to 11.2 or later, which the description states fixes the traversal.
• If immediate upgrade is not possible, restrict access to webmail/client/skins/default/css/css.php and webmail/old/calendar/minimizer/index.php at the reverse proxy or WAF.
• Run the webmail service with least privilege and confirm it cannot read sensitive files such as configuration or credential stores.
• Remove or disable the legacy webmail/old/calendar/minimizer component if it is not required.
• Audit exposed IceWarp webmail instances and block external access where it is not business-necessary.

Detection

• Search web server and proxy logs for requests to css.php or minimizer/index.php containing dot-dot traversal sequences in file, script or style parameters.
• Alert on URL-encoded traversal patterns (%2e%2e, ..%2f, .../) targeting IceWarp webmail paths.
• Monitor for unusual reads of configuration or credential files by the web server process.
• Review outbound or internal access to IceWarp webmail from unexpected source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.